Internal Controls: The Key to Good Business Practices. University Controller s Office

Transcription

1 Internal Controls: The Key to Good Business Practices University Controller s Office

2 Internal Control Defined Internal controls are the methods and procedures designed by management to safeguard assets and to manage resources. It s a system of checks and balances. A system of internal controls serves to minimize errors in the accounting records and to deter fraud, embezzlement and theft by employees, customers and vendors.

3 Objectives of Internal Controls The system of internal control provides reasonable assurance of the following: Reliable financial reporting Efficient and effective operations Compliance with applicable state and federal laws/regulations and university policies and procedures Safeguarding assets

4 Responsibility for Internal Controls All employees of the University are responsible for compliance with internal controls. Management is responsible for ensuring that internal controls are established, properly documented and adhered to. Establish the tone at the top and promote an ethical business environment by providing structure, feedback and discipline.

5 Control Environment VCU Controller s Office Management is responsible for setting the tone for the university. Management should foster a control environment that encourages: the highest levels of integrity and personal and professional standards a leadership philosophy and operating style which promote internal control throughout the university assignment of authority and responsibility

6 Control Environment The control environment is greatly influenced by the extent to which individuals recognize that they will be held accountable. The control environment is the control consciousness of the university. It is the atmosphere in which people conduct their activities and carry out their control responsibilities.

7 Control Environment & VCU s Quest for Distinction VCU s Quest for Distinction commits to a sound control environment. It communicates the importance through the following Core Values: Accountability committing to the efficient and transparent stewardship of our resources to achieve institutional excellence. Integrity adhering to the highest standards of honesty, respect and professional and scholarly ethics.

8 Risk Assessment Risk assessment is the identification and analysis of risks associated with the achievement of operations, financial reporting and compliance objectives. It is important to complete a risk assessment when business processes change and volume of business increases.

9 Risk Assessment Asking the following questions helps to identify risks: What could go wrong? Where are we vulnerable? What assets do we need to protect? How could someone steal from the department?

10 Risk Assessment After risks have been identified: Assess the likelihood (or frequency) of the risk occurring. Estimate the potential impact if the risk were to occur. Determine how the risk should be managed and decide what actions are necessary.

11 Control Activities Control Activities are actions, supported by policies and procedures that, when carried out properly and in a timely manner, manage or reduce risks. Control Activities include approvals, authorizations, verifications, reconciliations, reviews of performance, security of assets and segregation of duties.

12 Control Activities Controls can be preventive or detective. Preventive controls attempt to deter or prevent undesirable events from occurring. They are proactive controls that help to prevent a loss. Examples of preventive controls are separation of duties, proper authorization, adequate documentation and physical control over assets.

13 Control Activities Detective controls attempt to detect undesirable acts. They provide evidence that a loss has occurred but do not prevent the loss from occurring. Examples of detective controls are reviews, reconciliations, physical inventories and audits. Both preventive and detective controls are essential to an effective internal control system. Now we will take a closer look at control activities.

14 Control Activities Approvals (Preventive) Written policies and procedures Limits to authority Supporting documentation Question unusual items No rubber stamps No blank signed forms Authorization/approval is an important control activity.

15 Control Activities Approvals (Preventive) Approval of transactions means that the approver has reviewed the supporting documentation and is satisfied that the transaction is appropriate, accurate and complies with applicable laws, regulations, policies, and procedures. Approvers should question unusual items and make sure that necessary information is present to justify a transaction before they approve a financial transaction.

16 Control Activities Approvals (Preventive) Under no circumstances should an approver tell someone that they can sign the approver s name on behalf of the approver. You should never enter receiving information in Banner if you do not have personal knowledge that VCU acquired the good or service for business purposes. If someone else asks you to enter receiving information and you do not have first hand knowledge, you need a written form of verification from someone who does have first hand knowledge or the packing slip from the vendor. Under no circumstance should an employee share his/her system password or access/security level with another person.

17 Control Activities Approvals (Preventive) When signing your approval to reconciliations, P-card logs, journal entries etc., you are certifying that the expense is appropriate and it is for a legitimate business purpose for the university. Purchases must be considered essential to the operation of the university and in support of our mission. Since all expenditures are subject to public scrutiny, we should consider the appearance of unusual purchases on the institution, and on State government in general, prior to authorization. We must be mindful that we are entrusted to spend all sources of funds, whether from taxpayers, sponsors, donors, or students, in a prudent manner.

18 Control Activities Reconciliations (Detective) VCU Controller s Office A reconciliation is a comparison of different sets of data to one another, identifying and investigating differences, and taking corrective action when necessary. A critical element of the reconciliation process is to resolve differences. It does no good to note differences and do nothing about it. Reconciliations should be documented and approved by management in a timely manner.

19 Control Activities Reviews (Detective) Budget to actual comparison Current to prior period comparison Performance indicators Follow-up on unexpected results or unusual items Reviewing reports, statements, reconciliations and other information by management is an important control activity.

20 Control Activities Reviews (Detective) Management should review such information for consistency and reasonableness. Reviews of performance provide a basis for detecting problems. They help you identify unexpected results or unusual conditions which require follow-up.

21 Control Activities Segregation of Duties (Preventive & Detective) VCU Controller s Office No one person should Initiate the transaction Approve the transaction Record the transaction Reconcile balances Handle assets Review reports At least two sets of eyes!

22 Control Activities Segregation of Duties (Preventive & Detective) Segregation of duties is critical to effective internal control. It reduces the risk of both erroneous and inappropriate actions. When functions cannot be separated due to small department size, a detailed supervisory review of related activities is required as a compensating control activity. Segregation of duties is a deterrent to fraud because it requires collusion with another person to perpetrate a fraudulent act.

23 Monitoring Monitoring is the assessment of internal control performance over time. It is accomplished by ongoing monitoring activities. The purpose of monitoring is to determine whether internal control is adequately designed, properly executed, and effective. Ongoing monitoring helps to ensure that control activities and other planned actions are carried out properly and in a timely manner and that the end result is effective internal control.

24 Monitoring Management s role in the internal control system is critical to its effectiveness. Managers do not have to look at every piece of information to determine that controls are functioning and should focus their monitoring activities on high risk areas. The use of spot checks of transactions can provide a reasonable level of confidence that the controls are functioning as intended.

25 Internal Control An effective internal control system is essential to ensuring responsible stewardship over resources to achieve goals as set forth in VCU s Quest for Distinction. Fiscal Managers have a responsibility to assist the department chairs and deans with responsible stewardship of the resources of the University.

26 Fiscal Responsibility VCU Controller s Office Fiscal managers should: Frequently review the expenditure of funds to ensure that they are used in the most effective manner to achieve the mission of the department and the University Exercise the closest personal supervision practical over the entire fiscal process Monitor budgets Please refer to the responsibility matrix that is on the Fiscal Handbook web site for a list of policies and procedures that every fiscal manager should understand

27 High Risk Areas Requires Greater Attention to Internal Control Activities Cash Handling Petty Cash Gift Cards Credit Card Personal/Travel Reimbursements VCU Treasury Services

28 Preventive Control Activities Review Policies & Procedures Adequate Training Periodic Reminders Timely Depositing Safeguarding Funds Authorizations PC Security Separation of Duties Suspension and Termination Provisions VCU Treasury Services

29 Detective Control Activities Prompt Reconciliations Immediately Report Discrepancies Local Funds Cover Shortages Proper Recording Periodic Audits Reviews and Approvals Separation of Duties VCU Treasury Services

30 Budget Management Policy Individual Vice Presidents have oversight responsibility for monitoring and controlling operating budgets for units under their purview. The Vice President for Finance and Administration has overall responsibility for ensuring that the University as a whole remains within authorized budget levels.

31 Budget Management Policy Departmental administrators and fiscal personnel are responsible for reviewing information in Banner Finance for accuracy and ensuring that sufficient revenue budget and expenditure budget is available to support the fiscal year activities. In the event that a Banner org/index goes into a deficit, the deficit must be resolved as soon as possible but no later than the next month-end.

32 Top Ten Do s 1. Require your fiscal staff to attend fiscal training offered by Procurement Services. 2. Know your delegated purchasing authority is $10,000 and involve Procurement Services early in the process if you have questions or are unsure how to best procure something. 3. Plan ahead for fiscal year-end and HEETF procurements to ensure sufficient time for proper procurement, vendor product lead time, inspection/testing upon delivery, and invoice payment. 4. Understand that certain business activities involve higher risk (e.g. personal reimbursements, travel reimbursements, purchasing card, petty cash) and therefore require closer monitoring. 5. Understand that all procurements, travel reimbursements, personal reimbursements, and any other expenditures are subject to public inspection upon request.

33 Top Ten Do s 6. Know and apply the Richmond Times-Dispatch Front Page Test (RTD Test) on all expenditures. 7. Be familiar with the Allowable/Non-allowable Expenditures policy. 8. Recognize that fraud does occur and is most often found when a trusted employee is given too much autonomy with no oversight controls. 9. All travel and meal reimbursements must be for official university business purposes only. 10. Support diverse suppliers in procurement activities (SWaM = Small, Women-, and Minority-owned businesses).

34 Top Ten Don ts 1. Sign vendor contracts. 2. Ignore or procrastinate when a vendor fails to perform. 3. Sign expenditure documents without fully understanding them and performing the appropriate level of review and due diligence. 4. Violate the provisions of the Ethics in Public Contracting in the Virginia Public Procurement Act. 5. Delay completing receiving reports in Banner when goods and services are received (Prompt Pay Management Standard). 6. Expect Procurement Services to catch every questionable expenditure transaction before payment.

35 Top Ten Don ts 7. Think an employee s right to access/use the University s financial systems (eva and Banner) cannot be suspended or revoked for improper use. 8. Expend Grant funds in a manner that doesn t comply with University expenditure policies and procedures. 9. Fail to review P-card transactions monthly to ensure appropriateness and compliance with procedures. 10. Presume all receipts are truly original receipts and all items have been properly received in the office.

36 Internal Control The tone at the top has been set in VCU s Quest for Distinction now we must all do our part to ensure these goals are met.